# Xml-file too big for logstash? **URL:** \ **Category:** Logstash\ **Created:** [April 30, 2019, 6:04am UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016 "2019-04-30T06:04:29Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![nane96](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@nane96](https://discuss.elastic.co/u/nane96)\ **Post date:** [May 9, 2019, 5:51am UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/21 "2019-05-09T05:51:37Z")
that's what my filter is currently looking like by the way: ``` filter { xml { source => "message" target => "[theXML]" store_xml => true remove_namespaces => true force_array => false remove_field => ["message"] } ruby { path => '/home/christiane/splitData.rb' script_params => {field => "[theXML][Event]" target => "[theXML][Event]"} } # ruby { # code => ' # e = event.get("[theXML][Event][EventData][Data]") # if e.kind_of?(Array) # e.each { |x| # event.set(x["Name"], x["content"]) # } # else # event.set(e["Name"], e["content"]) # end # ' # } # mutate { # copy => { # "[theXML][Event][System][Provider]" => "Provider" # "[theXML][Event][System][EventID]" => "EventID" # "[theXML][Event][System][Version]" => "Version" # "[theXML][Event][System][Level]" => "Level" # "[theXML][Event][System][Task]" => "Task" # "[theXML][Event][System][Opcode]" => "Opcode" # "[theXML][Event][System][Keywords]" => "Keywords" # "[theXML][Event][System][TimeCreated]" => "TimeCreated" # "[theXML][Event][System][TimeCreated][SystemTime]" => "SystemTime" # "[theXML][Event][System][EventRecordID]" => "EventRecordID" # "[theXML][Event][System][Correlation]" => "Correlation" # "[theXML][Event][System][Execution]" => "Execution" # "[theXML][Event][System][Channel]" => "Channel" # "[theXML][Event][System][Computer]" => "Computer" # "[theXML][Event][System][Security]" => "Security" # } # } date { match => ["[theXML][Event][System][TimeCreated][SystemTime]", "YYYY-MM-dd HH:mm:s$ timezone => "Europe/Berlin" } } ``` ---
**Author:** ![nane96](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@nane96](https://discuss.elastic.co/u/nane96)\ **Post date:** [May 9, 2019, 6:41am UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/22 "2019-05-09T06:41:25Z")
okay nevermind, it's not the other ruby part, it's the mutate filter. I guess it doesn't work like that (with copy) without the [@metadata]? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 3:24pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/23 "2019-05-09T15:24:15Z")
> [@nane96](#): > > "[theXML][Event][System][Provider]" =\> "Provider" If I am reading it correctly, there is no such field. It should be [theXML][System][Provider] ---
**Author:** ![nane96](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@nane96](https://discuss.elastic.co/u/nane96)\ **Post date:** [May 10, 2019, 10:28am UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/24 "2019-05-10T10:28:20Z")
I honestly don't know why the output looked like that, there's a field called [theXML][System][Provider]. I actually tried to comment it back in after trying around a few other things, and it works now, I really don't know why. The only thing left now is that there are still the "original" fields (called something like theXML.Event.System.Provider...) that I copied into the new fieldnames in the mutate-copy filter when I upload it in kibana. Is there a way to just delete them all without having to remove each one specifically? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 10, 2019, 1:12pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/25 "2019-05-10T13:12:36Z")
If you use mutate+remove\_field to remove theXML it will remove all the sub-fields too. ---
**Author:** ![nane96](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@nane96](https://discuss.elastic.co/u/nane96)\ **Post date:** [May 13, 2019, 6:53pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/26 "2019-05-13T18:53:11Z")
but I would have to use that after the first mutate filter and the date filter, right? that's what it currently looks like: ``` mutate { copy => { "[theXML][Event][System][Provider]" => "Provider" "[theXML][Event][System][EventID]" => "EventID" "[theXML][Event][System][Version]" => "Version" "[theXML][Event][System][Level]" => "Level" "[theXML][Event][System][Task]" => "Task" "[theXML][Event][System][Opcode]" => "Opcode" "[theXML][Event][System][Keywords]" => "Keywords" "[theXML][Event][System][TimeCreated]" => "TimeCreated" "[theXML][Event][System][TimeCreated][SystemTime]" => "SystemTime" "[theXML][Event][System][EventRecordID]" => "EventRecordID" "[theXML][Event][System][Correlation]" => "Correlation" "[theXML][Event][System][Execution]" => "Execution" "[theXML][Event][System][Channel]" => "Channel" "[theXML][Event][System][Computer]" => "Computer" "[theXML][Event][System][Security]" => "Security" } } date { match => ["[theXML][Event][System][TimeCreated][SystemTime]", "YYYY-MM-dd HH:mm:ss.SSSSSS"] timezone => "Europe/Berlin" } mutate { remove_field => ["[theXML]"] } ``` but like that I only get one Event when I look at it in Kibana. Is there something wrong with it? I don't get an Error or anything, but just one Event. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 13, 2019, 7:17pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/27 "2019-05-13T19:17:42Z")
Then I imagine the split filter did not find the field it was set to split. ---
**Author:** ![nane96](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@nane96](https://discuss.elastic.co/u/nane96)\ **Post date:** [May 13, 2019, 8:35pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/28 "2019-05-13T20:35:11Z")
But without the remove\_field the split works perfectly now, is that possible if it didnt find the right field? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 10, 2019, 8:35pm UTC](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016/29 "2019-06-10T20:35:12Z")
Closed on June 10, 2019, 8:35pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/xml-file-too-big-for-logstash/179016.md?page=1)